diff --git a/cmd/natc/ippool/ippool.go b/cmd/natc/ippool/ippool.go
index 641702f5d..e9f705ea3 100644
--- a/cmd/natc/ippool/ippool.go
+++ b/cmd/natc/ippool/ippool.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// ippool implements IP address storage, creation, and retrieval for cmd/natc
+// Package ippool implements IP address storage, creation, and retrieval for cmd/natc.
 package ippool
 
 import (
diff --git a/feature/buildfeatures/buildfeatures.go b/feature/buildfeatures/buildfeatures.go
index ca4de7434..d2ce8f89e 100644
--- a/feature/buildfeatures/buildfeatures.go
+++ b/feature/buildfeatures/buildfeatures.go
@@ -3,8 +3,8 @@
 
 //go:generate go run gen.go
 
-// The buildfeatures package contains boolean constants indicating which
-// features were included in the binary (via build tags), for use in dead code
-// elimination when using separate build tag protected files is impractical
-// or undesirable.
+// Package buildfeatures contains boolean constants indicating which features
+// were included in the binary (via build tags), for use in dead code
+// elimination when using separate build tag protected files is impractical or
+// undesirable.
 package buildfeatures
diff --git a/feature/condregister/condregister.go b/feature/condregister/condregister.go
index e0d72b7ac..7a384aa6d 100644
--- a/feature/condregister/condregister.go
+++ b/feature/condregister/condregister.go
@@ -1,9 +1,9 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The condregister package registers all conditional features guarded
-// by build tags. It is one central package that callers can empty import
-// to ensure all conditional features are registered.
+// Package condregister registers all conditional features guarded by build
+// tags. It is one central package that callers can empty import to ensure all
+// conditional features are registered.
 package condregister
 
 import (
diff --git a/feature/doctor/doctor.go b/feature/doctor/doctor.go
index 01897f0a6..26c3ff0d1 100644
--- a/feature/doctor/doctor.go
+++ b/feature/doctor/doctor.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The doctor package registers the "doctor" problem diagnosis support into the
+// Package doctor registers the "doctor" problem diagnosis support into the
 // rest of Tailscale.
 package doctor
 
diff --git a/feature/featuretags/featuretags.go b/feature/featuretags/featuretags.go
index 1348cc15d..bacf234fc 100644
--- a/feature/featuretags/featuretags.go
+++ b/feature/featuretags/featuretags.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The featuretags package is a registry of all the ts_omit-able build tags.
+// Package featuretags is a registry of all the ts_omit-able build tags.
 package featuretags
 
 import "tailscale.com/util/set"
diff --git a/k8s-operator/api.md b/k8s-operator/api.md
index d77823037..408d233b9 100644
--- a/k8s-operator/api.md
+++ b/k8s-operator/api.md
@@ -6,6 +6,7 @@
 
 ## tailscale.com/v1alpha1
 
+Package v1alpha1 documents the k8s-operator API.
 
 ### Resource Types
 - [Connector](#connector)
diff --git a/k8s-operator/apis/v1alpha1/doc.go b/k8s-operator/apis/v1alpha1/doc.go
index 0fc5bb8ec..39c5be699 100644
--- a/k8s-operator/apis/v1alpha1/doc.go
+++ b/k8s-operator/apis/v1alpha1/doc.go
@@ -3,6 +3,7 @@
 
 //go:build !plan9
 
+// Package v1alpha1 documents the k8s-operator API.
 // +kubebuilder:object:generate=true
 // +groupName=tailscale.com
 package v1alpha1
diff --git a/k8s-operator/sessionrecording/ws/conn.go b/k8s-operator/sessionrecording/ws/conn.go
index c6c543dfe..88ae94602 100644
--- a/k8s-operator/sessionrecording/ws/conn.go
+++ b/k8s-operator/sessionrecording/ws/conn.go
@@ -3,7 +3,7 @@
 
 //go:build !plan9
 
-// package ws has functionality to parse 'kubectl exec/attach' sessions streamed using
+// Package ws has functionality to parse 'kubectl exec/attach' sessions streamed using
 // WebSocket protocol.
 package ws
 
diff --git a/net/netmon/netmon.go b/net/netmon/netmon.go
index 087cf4162..2f87d536f 100644
--- a/net/netmon/netmon.go
+++ b/net/netmon/netmon.go
@@ -1,9 +1,9 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package monitor provides facilities for monitoring network
-// interface and route changes. It primarily exists to know when
-// portable devices move between different networks.
+// Package netmon provides facilities for monitoring network interface and
+// route changes. It primarily exists to know when portable devices move
+// between different networks.
 package netmon
 
 import (
diff --git a/net/stun/stun.go b/net/stun/stun.go
index 24c11e147..e7fad05a1 100644
--- a/net/stun/stun.go
+++ b/net/stun/stun.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package STUN generates STUN request packets and parses response packets.
+// Package stun generates STUN request packets and parses response packets.
 package stun
 
 import (
diff --git a/net/tstun/tun.go b/net/tstun/tun.go
index 42b0d239c..aedd8750e 100644
--- a/net/tstun/tun.go
+++ b/net/tstun/tun.go
@@ -3,8 +3,8 @@
 
 //go:build !wasm && !tamago && !aix && !solaris && !illumos
 
-// Package tun creates a tuntap device, working around OS-specific
-// quirks if necessary.
+// Package tstun creates a tuntap device, working around OS-specific quirks if
+// necessary.
 package tstun
 
 import (
diff --git a/portlist/portlist.go b/portlist/portlist.go
index 9430e2562..c3319dcdf 100644
--- a/portlist/portlist.go
+++ b/portlist/portlist.go
@@ -3,8 +3,8 @@
 
 // This file is just the types. The bulk of the code is in poller.go.
 
-// The portlist package contains code that checks what ports are open and
-// listening on the current machine.
+// Package portlist contains code that checks what ports are open and listening
+// on the current machine.
 package portlist
 
 import (
diff --git a/staticcheck.conf b/staticcheck.conf
index 1a90998c5..b25659b1a 100644
--- a/staticcheck.conf
+++ b/staticcheck.conf
@@ -17,7 +17,7 @@ checks = [
 	# https://github.com/golang/go/wiki/CodeReviewComments, then it
 	# may be an acceptable check.
 
-	# TODO(crawshaw): enable when we have docs? "ST1000", # missing package docs
+	"ST1000", # missing package docs
 	"ST1001", # discourage dot imports
 
 	"QF1004", # Use `strings.ReplaceAll` instead of `strings.Replace` with `n == 1`
diff --git a/tstest/deptest/deptest.go b/tstest/deptest/deptest.go
index 59672761e..74cf8f791 100644
--- a/tstest/deptest/deptest.go
+++ b/tstest/deptest/deptest.go
@@ -1,9 +1,9 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The deptest package contains a shared implementation of negative
-// dependency tests for other packages, making sure we don't start
-// depending on certain packages.
+// Package deptest contains a shared implementation of negative dependency
+// tests for other packages, making sure we don't start depending on certain
+// packages.
 package deptest
 
 import (
diff --git a/tstest/tkatest/tkatest.go b/tstest/tkatest/tkatest.go
index 2726b4dec..09b785e86 100644
--- a/tstest/tkatest/tkatest.go
+++ b/tstest/tkatest/tkatest.go
@@ -1,8 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// tkatest has functions for creating a mock control server that responds
-// to TKA endpoints.
+// Package tkatest has functions for creating a mock control server that
+// responds to TKA endpoints.
 package tkatest
 
 import (
diff --git a/types/appctype/appconnector.go b/types/appctype/appconnector.go
index 6be5d51b5..c7ffc1241 100644
--- a/types/appctype/appconnector.go
+++ b/types/appctype/appconnector.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// Package appcfg contains an experimental configuration structure for
+// Package appctype contains an experimental configuration structure for
 // "tailscale.com/app-connectors" capmap extensions.
 package appctype
 
diff --git a/util/ctxkey/key.go b/util/ctxkey/key.go
index 982c65f04..403ad5c68 100644
--- a/util/ctxkey/key.go
+++ b/util/ctxkey/key.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// ctxkey provides type-safe key-value pairs for use with [context.Context].
+// Package ctxkey provides type-safe key-value pairs for use with [context.Context].
 //
 // Example usage:
 //
diff --git a/util/goroutines/goroutines.go b/util/goroutines/goroutines.go
index f184fcd6c..a49d0690c 100644
--- a/util/goroutines/goroutines.go
+++ b/util/goroutines/goroutines.go
@@ -1,7 +1,7 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// The goroutines package contains utilities for tracking and getting active goroutines.
+// Package goroutines contains utilities for tracking and getting active goroutines.
 package goroutines
 
 import (
diff --git a/util/nocasemaps/nocase.go b/util/nocasemaps/nocase.go
index 737ab5de7..9001647bb 100644
--- a/util/nocasemaps/nocase.go
+++ b/util/nocasemaps/nocase.go
@@ -1,8 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
-// nocasemaps provides efficient functions to set and get entries in Go maps
-// keyed by a string, where the string is always lower-case.
+// Package nocasemaps provides efficient functions to set and get entries in Go
+// maps keyed by a string, where the string is always lower-case.
 package nocasemaps
 
 import (
diff --git a/util/osshare/filesharingstatus_noop.go b/util/osshare/filesharingstatus_noop.go
index 22f0a3378..8b6dd4ab7 100644
--- a/util/osshare/filesharingstatus_noop.go
+++ b/util/osshare/filesharingstatus_noop.go
@@ -3,6 +3,8 @@
 
 //go:build !windows
 
+//lint:file-ignore ST1000 see filesharingstatus_windows.go
+
 package osshare
 
 import (
diff --git a/util/winutil/authenticode/mksyscall.go b/util/winutil/authenticode/mksyscall.go
index 198081fce..cf9c1f575 100644
--- a/util/winutil/authenticode/mksyscall.go
+++ b/util/winutil/authenticode/mksyscall.go
@@ -1,6 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
+//lint:file-ignore ST1000 see authenticode_windows.go
+
 package authenticode
 
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
diff --git a/util/winutil/gp/mksyscall.go b/util/winutil/gp/mksyscall.go
index 1ddbebb37..9c733e8ea 100644
--- a/util/winutil/gp/mksyscall.go
+++ b/util/winutil/gp/mksyscall.go
@@ -1,6 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
+//lint:file-ignore ST1000 see gp_windows.go
+
 package gp
 
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
diff --git a/util/winutil/s4u/mksyscall.go b/util/winutil/s4u/mksyscall.go
index b8ab33672..7810f843b 100644
--- a/util/winutil/s4u/mksyscall.go
+++ b/util/winutil/s4u/mksyscall.go
@@ -1,6 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
+//lint:file-ignore ST1000 see s4u_windows.go
+
 package s4u
 
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go
diff --git a/util/winutil/winenv/mksyscall.go b/util/winutil/winenv/mksyscall.go
index 77d8ec66a..1452c480f 100644
--- a/util/winutil/winenv/mksyscall.go
+++ b/util/winutil/winenv/mksyscall.go
@@ -1,6 +1,8 @@
 // Copyright (c) Tailscale Inc & contributors
 // SPDX-License-Identifier: BSD-3-Clause
 
+//lint:file-ignore ST1000 see winenv_windows.go
+
 package winenv
 
 //go:generate go run golang.org/x/sys/windows/mkwinsyscall -output zsyscall_windows.go mksyscall.go